A New China-Aligned Cluster Emerges

Researchers have documented a previously unreported threat actor tracked as Bronze Sandcastle, a China-aligned cluster that has been targeting organizations across Asia and Africa since at least mid-2025. The findings, published by Sophos security researcher Gabor Szappanos, describe a campaign whose most recognizable fingerprint is a consistent reliance on DLL sideloading involving Sandboxie, the well-known sandboxing utility for Windows.

According to the analysis, Bronze Sandcastle's operations stand out less for exotic exploits than for disciplined tradecraft: the group repeatedly abuses a legitimate, signed application to load malicious code, a technique that can slip past controls tuned to flag unsigned binaries or obvious malware droppers.

What DLL Sideloading Achieves for the Attacker

DLL sideloading is a classic living-off-the-land technique. Many Windows applications load supporting libraries from predictable locations, and if an attacker can place a crafted DLL alongside a trusted executable, the program will load it automatically. Because the host binary is legitimate and often digitally signed, the resulting execution can appear benign to endpoint tooling that trusts signed software.

In Bronze Sandcastle's case, Sandboxie serves as that trusted host. By pairing a Sandboxie component with a malicious library, the operators gain a stealthy execution path for their payloads without needing to register new services or drop conspicuous standalone malware. The consistency of this pattern across intrusions is what allowed researchers to attribute the activity to a single cluster rather than a loose collection of unrelated incidents.

Targeting Asia and Africa

The campaign's victimology points to organizations in Asia and Africa, regions that have featured prominently in Chinese-nexus espionage and intrusion sets in recent years. Sophos characterized the activity as an espionage-oriented cluster, though the specific sectors and the full scope of compromised entities were not detailed in the initial disclosure. The timeline — activity observed since mid-2025 — suggests a sustained operation rather than a short-lived burst.

The Payload: Backdoors and Persistence

The end goal of the Sandboxie sideloading chain is the deployment of backdoors that give operators persistent remote access. Once the sideloaded library executes, it can establish command-and-control channels, stage additional tooling, and maintain a foothold on the host. The use of a sandboxing utility as a loader is notable because it lets the group blend intrusion activity into environments where security teams may already be accustomed to seeing sandbox-related software.

Why This Matters for Defenders

The Bronze Sandcastle disclosure reinforces a broader trend: nation-state-linked actors increasingly favor abusing legitimate, signed software over deploying bespoke malware loaders. Defenders should treat this as a detection-engineering problem as much as a threat-intelligence one.

  • Monitor for anomalous DLL loads. Alert on signed executables — including Sandboxie components — loading libraries from unexpected directories or user-writable paths.
  • Hunt for sideloading patterns. Correlate process creation events where known-good binaries spawn or load unsigned or recently written DLLs.
  • Inventory legitimate utilities. Sandboxing and virtualization tools are common in developer and testing environments; knowing where they are installed and who uses them makes unusual placement easier to spot.
  • Apply application control. Restricting execution to approved paths can break sideloading chains before the payload runs.
  • Track China-nexus tradecraft. The cluster's consistent use of a single technique is a useful pivot for retro-hunting across historical telemetry.

Context and Caveats

The Sophos research provides an initial technical profile of Bronze Sandcastle, but public details remain limited. Attribution to a China-aligned actor rests on tradecraft and targeting patterns rather than on infrastructure exclusively tied to a known group. As with most cluster-level reporting, defenders should use the indicators and behavioral patterns as hunting guidance rather than as a definitive identification of the adversary behind any single intrusion.

The group's focus on Asia and Africa also fits a wider pattern of regional targeting by Chinese-nexus actors, which makes Bronze Sandcastle worth watching for organizations operating in or connected to those regions.

The Bottom Line

Bronze Sandcastle demonstrates that a single, well-chosen technique — abusing a trusted sandboxing tool to sideload a backdoor — can carry an entire intrusion campaign. For security teams, the lesson is to look beyond file hashes and signatures and focus on behavior: which binaries are loading which libraries, from where, and why.

Read the original report: The Hacker News — China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors